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WHAT IS CLAIMED IS : 

1. / A system for identifying fraud in a telecommunications system, the system for 
identifying fraud comprising at least one processor, memory and related software, the at least one 
processor receiving data related to a current call placed from an originating automatic number 
mdicator (ANI) to a terminating AM, the received data including at least the terminating AM and 
a billing number, the processor retrieving from memory billing numbers for prior calls to the 
terminating AM, if any, and an indicia of the time of the call, and the processor also determining 
whether the number of billing numbers used for the current and prior calls to the terminating AM 
over a prior period of time falling within a time interval satisfying a threshold, a fraud alert being 
generated if the threshold is satisfied. 

2. The system as in Claim 1, wherein the billing numbers and indicia of time for prior 
calls to the terminating AM are included in calling records stored in the memory, each calling 
record containing data for one prior call to the terminating AM, the calling record being 
referenced by terminating AM and including the billing number used for the call and an indicia of 
the time of the call. 

3. The system as in Claim 2, wherein a calling record is created for the current call. 

4. The system as in Claim 1, wherein the threshold number and time interval 
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corresponding to at least one terminating ANI is included in a look-up table stored in the memory. 

5. The system as in Claim 4, wherein at least some terminating AMs in the look-up 
table have two or more threshold numbers and time intervals corresponding thereto, the two or 
more thresholds and time intervals corresponding to each such terminating ANI referenced by one 
or more additional factors. 

6. The system as in Claim 5, wherein the one or more additional factors are selected 
from the time of day, the day of the week, the type of originating ANI of the current call, the 
category of billing product used for the current call and the type of billing product used for the 
current call. 

7. The system as in Claim 6, wherein the data received by the processor related to the 
current call to the terminating ANI includes data corresponding to the one or more additional 
factors, and the processor selects one of the thresholds and time intervals for the terminating ANI 
using the received data corresponding to the one or more additional factors. 

8. The system as in Claim 1, wherein the prior period of time spans from the time of 
the current call backwards in time equal to the time interval, the processor counting the number of 
different billing numbers for the current call and all prior calls to the terminating ANI that fall 
within the prior period of time and comparing the number with the threshold. 
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9. The system as in Claim 1, wherein data related to the current call is received by the 
at least one processor from components of said telecommunications system that receive and 



comprising the steps of: 

a) receiving data related to a current call placed from an originating ANI to a 
terminating ANI, the received data including at least the terminating ANI and a billing 
number; 

b) retrieving billing numbers for prior calls to the terminating ANI, if any, and 
corresponding indicia of the times of the calls; 

c) determining whether the number of billing numbers used for the current 
and prior calls to the terminating ANI over a prior period of time falling within a time 
interval satisfies a threshold number; and 



11. The method as in Claim 10, wherein the billing numbers and indicia of time for 
prior calls to the terminating ANI are retrieved from stored calling records, each calling record 
containing data for one prior call to the terminating ANI, the calling record being referenced by 
the terminating ANI and including the billing number used for the call and an indicia of the time of 



process special services calls. 




A method of identifying fraud in a telecommunications system, the method 



d) generating a fraud alert if the threshold number is satisfied. 



the call 
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12. The method as in Claim 1 1, the method including the additional step of creating a 
calling record for the current call and storing the calling record, the calling record including the 
terminating ANI, the billing number and an indicia of the time of the call, the calling record being 
referenced in the memory by the terminating ANI. 

13. The method as in Claim 10, including the additional step of retrieving the threshold 
number and time interval for the terminating AM. 

14. The method as in Claim 13, wherein the step of retrieving the threshold number 
and time interval for the terminating AMI includes selecting among two or more threshold 
numbers and time intervals for the terminating ANI. 

15. The method as in Claim 14, wherein one of the two or more threshold numbers 
and time intervals for the terminating ANI are selected based upon one or more additional factors. 

16. The method as in Claim 1 5, wherein the data relating to the one or more additional 
factors is received with the data related to the current call. 

1 7. The method as in Claim 1 0, wherein the step of determining whether the number of 
billing numbers used for the current and prior calls to the terminating ANI over a prior period of 
time falling within the time interval satisfies the threshold number includes counting the number 
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of different billing numbers for the current call and all prior calls to the terminating ANI spanning 
from the time of the current call backwards in time equal to the time interval and comparing the 
count of different billing numbers with the threshold number. 

18. The method as in Claim 10, wherein the generation of a fraud alert initiates 
processing related to prevention of fraudulent calling to the terminating ANI. 

19. The method as in Claim 10, wherein the threshold is satisfied if it is met or 
exceeded. 

20. The method as in Claim 10, wherein the threshold is satisfied if it is exceeded. 

21. The method as in Claim 10, wherein the prior period of time is less than or equal 
to the time interval. 

22. The method as in Claim 10, wherein the prior period of time is less than the time 
interval 

23. The method as in Claim 10, wherein the step of generating a fraud alert is 
followed by further processing, including the step of blocking subsequent calls to the terminating 
AM, 
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24. The method as in Claim 10, wherein the step of generating a fraud alert is 
followed by further processing, including the step of blocking subsequent calls that use the billing 
numbers used for the current and prior calls to the terminating ANI. 

A method of identifying fraud in a telecommunications system, the method 
comprising the steps of: 

a) receiving data related to a current call placed to a terminating ANI, the 
received data including the terminating ANI and a billing number; 

b) storing the received data and an indicia of the time of the call; 

c) at an initiating event, retrieving the billing numbers and corresponding 
indicia of times of calls to the terminating ANI; 

d) determining whether the number of billing numbers used for calls to the 
terminating ANI over a prior period of time falling within a time interval satisfies a 
threshold; and 

e) generating a fraud alert if the threshold is satisfied. 

26. The method as in Claim 25, wherein the initiating event is the receipt of data 
related to the current call placed to the terminating AMI. 

27. The method as in Claim 25, wherein the initiating event is the elapse of a period of 

time. 
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